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Linear Codes from Some 2-Designs 

Cunsheng Ding 


Abstract 

A classical method of constructing a linear code over GF(g) with a f-design is to use the incidence matrix 
of the f-design as a generator matrix over GF(g') of the code. This approach has been extensively investigated in 
the literature. In this paper, a different method of constructing linear codes using specific classes of 2-designs is 
studied, and linear codes with a few weights are obtained from almost difference sets, difference sets, and a type 
of 2-designs associated to semibent functions. Two families of the codes obtained in this paper are optimal. The 
linear codes presented in this paper have applications in secret sharing and authentication schemes, in addition to 
their applications in consumer electronics, communication and data storage systems. A coding-theory approach to 
the characterisation of highly nonlinear Boolean functions is presented. 

Index Terms 

Almost bent functions, almost difference sets, bent functions, difference sets, linear codes, semibent functions, 
f-designs. 

I. Introduction 

Throughout this paper, let p be an odd prime and let q = p'^ for some positive integer m. An [n, K, d] 
eode C over GF(p) is a K-dimensional subspaee of GF(p)" with minimum (Hamming) distanee d. Let Ai 
denote the number of codewords with Hamming weight i in a code C of length n. The weight enumerator 

of C is defined by 1 +Aiz+A 2 Z^ -\ -A code C is said to be a f-weight code if the number of 

nonzero Ai in the sequence (Ai,A 2 , • • • ,A„) is equal to t. 

A finite incidence structure, denoted by (iP, “B, /), consists of two disjoint finite sets B and B, and a 
subset I of B X B. The members of B are called points and are normally denoted by lower-case Roman 
letters; the members of B are referred to as blocks and are normally denoted by upper-case Roman letters. 
If the ordered pair (p, B) is in IP x B, we say that p is incident with B, or B contains the point p, or that 
p is on B. 

An incidence structure B) = [B, B, I) is called a t-{n, k, X) design, or simply a t-design, where t, n, k 
and X are nonnegative integers, if 

1) \B\= n; 

2) every block B eB h incident with precisely k points; 

3) every t distinct points are together incident with precisely X blocks. 

Let B) = {B, B, I) be an incidence structure with n > I points and b > I blocks. The points of B 
are usually indexed with pi,P2,-" and the blocks of B are normally denoted by B\,B 2 , - ,Bh. The 

incidence matrix Mq^ = (mij) of ® is a Z? x n matrix where mtj = 1 if pj is on 5,- and mtj = 0 otherwise. 
It is clear that the incidence matrix depends on the labeling of the points and blocks of B>, but is 
unique up to row and column permutations. Conversely, every (0, l)-matrix (entries are 0 or 1) determines 
an incidence structure. Our definition of the incidence matrix follows reference Il2l[p.l2]. In some other 
references, the transpose of the matrix Mq) above is defined as the incidence matrix. When Mq) is viewed 
as a matrix over GF(p), it spans a linear code of length n over GF(p), denoted by Cp{B)) and called the 
linear code of the incidence structure. With this framework of construction, every t-design yields a linear 
code over GF(p). This approach to the construction of linear codes with t-designs has been extensively 
studied. 
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The objective of this paper is to study a different method of constructing linear codes using certain 
special types of 2-designs. In this paper, one-weight, two-weight and three-weight linear codes are obtained 
from almost difference sets, difference sets and a type of 2-designs associated with semibent functions. 
Two families of the linear codes presented in this paper are optimal. The linear codes with a few weights 
presented in this paper have applications in secret sharing |[T1 and authentication codes ETI . in addition 
to their applications in consumer electronics, communication and data storage systems. A coding-theory 
approach to the characterisation of highly nonlinear Boolean functions is presented in this paper. 

II. Mathematical foundations 

A. Almost dijference sets and difference sets 

For convenience later, we define the difference function of a subset D of (A, -t-) as 

diffo(x) = |Dn(D-fx)|, (1) 

where D-\-x = {y + x : y e D}. 

A subset D of size k in an abelian group (A, -|-) with order v is called a (v, k, k) difference set in (A, -t-) 
if the difference function diff£)(j£:) = X for every nonzero x E A. A difference set D in (A, -t-) is called 
cyclic if the abelian group A is so. 

If Z) is a (v, k, ?i) difference set in (A, -h), its complement, =A\D,hdi{v,v — k,v — 2k-\-X) difference 

set in (A, -h). 

Let D be a (v, k, X) difference set in an abelian group (A, -|-). We associate D with an incidence structure 
“D, called the development of D, by defining (D = (IP, “B, I), where B is the set of the elements in A, 

(B = {a -fZ) : a G A}, 

and the incidence Z is the membership of sets. Each block a-\-D = {a-\-x : x E D} is called a translate 
of D. The development ® of a difference set D is called a difference set design and also the translate 
design of D. 

Let d) be the development of a (v, k, ?i) difference set D in a group A. Then ® is a 2-(v, k, ?i) design 
^ Theorem 4.4.1]. Every difference set design defines a linear code Cp{d)) automatically, which was 
introduced in Section |I| 

Let (A, -h) be an abelian group of order v. A k-subset D of A is a (v, k, X, t) almost difference set of A 
if the difference function diffD(.r) takes on X altogether t times and ?i-|- 1 altogether v—\—t times when 
X ranges over all the nonzero elements of A. In the sequel, we will employ some almost difference sets 
to construct linear codes with only a few weights. 

B. Group characters in GE(^) 

An additive character of GE(^) is a nonzero function % from GE(^) to the set of nonzero complex 
numbers such that x{x + y) = x{x)x{y) for any pair {x,y) G GE(^)^. Eor each b G GE(^), the function 

for all c G GE(^) (2) 

defines an additive character of GE(^), where and whereafter £p = ^ primitive complex pth 

root of unity. When b = 0, %o(c) = 1 for all c G GE(^), and is called the trivial additive character of 
GE(^). The character X\ in @ is called the canonical additive character of GE(^). It is known that every 
additive character of GE(^) can be written as Xbix) = Xi(Bx) ll^ Theorem 5.7]. 
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III. A GENERIC CONSTRUCTION OF LINEAR CODES 
A. The description of the linear codes 

Let D = {d\, d 2 , ■ ■., dn} GF(^), where again q = p'". Let Tr denote the trace function from GF(^) 
onto GF(p) throughout this paper. We define a linear code of length n over GF(p) by 

Cd = {{^t:fcd\),i:t:{xd2),...,Tt:{xdn)) :TGGF((5r)}, (3) 

and call D the defining set of this code Cd- By definition, the dimension of the code Cd is at most m. 

This construction is generic in the sense that many classes of known codes could be produced by 
selecting the defining set D C GF(^). This construction technique was employed in lf20ll and ifT^ for 
obtaining linear codes with a few weights. The objective of this paper is to construct linear codes Cd 
using almost difference sets D and difference sets D as well as a few classes of 2-designs defined later. 
If the set D is well chosen, the code Cd may have good or optimal parameters. Otherwise, the code Cd 
could have bad parameters. 


B. The weights in the linear codes Cd 

It is convenient to define for each x G GF(^), 

Cx = (Tr(xJi), Tr{xd 2 ), ..., Tr(xJ„))- (4) 

The Hamming weight wt(Cx) of Cx is n — Nx{0), where 

A^x(0) = |{l<i<n:Tr(M)=0}| 

for each a: G GF(^). 

It is easily seen that for any D = {di, d 2 , ■■■, dn} C GF(^) we have 

= t E = £ Y. %,(yxd,)=n+ Y 

i=l)'eGF(/7) i=lyeGF(p) yeGF(p)* 

where %i is the canonical additive character of GF(^), aD denotes the set {ad : d G D}, and %i(5') := 
LxesXiW for ^riy subset S of GF(^). Hence, 

wt(Cx) =n-A^x(0) =-- — -. (5) 

P 


IV. Linear codes from skew sets 

A subset D of GF(^)* is called a skew set of GF(^) if D, —D and {0} form a partition of GF(^). 

Theorem 1. Let D be any skew set ofG¥{q). Then Cd Is a one-weight code over GF(p) with parameters 
[(^-l)/2,m, {p-\)q/lp]. 

Proof: Let D be a skew set of GF(^). By definition |D| — {q— l)/2 and xD is also a skew set of 
GF(^) for every x G GF(^)*. For any v G GF(^)*, it follows from dS]) that 

, , {p-\)q 

wt Cx --f-. 

P 2p 

The desired conclusions then follow. ■ 

We remark that the code of Theorem [T] is optimal as it meets the Griesmer bound. 

A skew Hadamard difference set in (GF(^), -t-) is both a difference set and a skew set. By definition, any 
skew Hadamard difference set in (GF(^), -f) must have parameters [q, [q— l)/2, (^ —3)/4), where ^ = 3 
(mod 4). According to Theorem [H any skew Hadamard difference set in (GF(^), -h) gives a one-weight 
code over GF(p). 

The first skew Hadamard difference set was the Paley set D, which is set of all nonzero squares in 
GF(^), where q = 3 (mod 4). Recently, many new constructions of skew Hadamard difference sets have 
been discovered. For detailed information, the reader is referred to lf23ll . [l22ll . Il27ll . [l45ll . and [l47ll . 
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V. Linear codes erom the images oe eunctions / on GF(^) 

Let f{x) be a funetion from GF(^) to GF(^). We define 

D(/):={/W:tgGF(^)}\{0}. 

In this seetion, we consider the code Co{f)- In general, it is difficult to determine the length nf := \D{f)\ 
of this code, not to mention its weight distribution. However, in certain special cases, the parameters and 
the weight distribution of C£){f) can be settled. 

A. The codes CD{f) from quadratic functions over GF(p"’) for odd p 

Throughout this section, let q = p'^ be odd. A polynomial / over GF(^) of the form 

/(^) = L L 

i^lj^J 

is called a quadratic form over GF(^), where atj G GF(^), and 7 and J are subsets of {0,1,2,... ,m — 1}. 

Note that GF(^) is a vector space of dimension m over GF(p). The rank of the quadratic form / over 
GF(^) is defined to be the codimension of the GF(p)-vector space 

Vf = {xe GF(^) : f{x + z)-nx)-f{z) = 0 for all z e GF(^)}. 

That is |V/| = where r denotes the rank of /. 

It is still very difficult to determine the length nf of the code CD{f) for general quadratic forms /, let 
alone the weight distribution of the code CD{f) ■ However, under certain conditions the weight distribution 
of Co(f) can be worked out. To this end, we need the following lemma Il52ll . 

Lemma 2. Let f be a quadratic form of rank r over GF(^). If r is even, then 

I I UyM) = ±{p-i)p"‘~i. 

yeGV{p)* xeGV{q) 

If r is odd, then 

E L xi(>'/W) = 0- 

jeGF(p)*xeGF(^) 

We are now ready to prove the following theorem. 

Theorem 3. Let f be a quadratic form of rank r over GF(^) such that 

• /(O) = 0 and f{x) 0 for all x G GF(^)*; and 

• / is e-to-l on GF(^)* (i.e. f{x) = u has either e solutions x G GF(^)* or no solution for each 
u G GF(^)*j, where e is a positive integer. 

If r is odd, then Co{f) A a one-weight code over GF(p) with parameters [{q — 1)/^, nr, [p— \)q/ep\. 
If r is even, then CD(f) A ci two-weight code over GF(p) with parameters [{q— l)/e, m, {p — 1)(^ — 
p'”~'^/2)/ep] and weight enumerator 


Proof: Since / is e-to-l in GF(^)*, we have that n/ = 

|f^(/)l = (^-l)/e and 

Y. Y 5ci(>'/W) 

= E ( 

1+ Y 5Ci(>'/W)) 

yeG¥{p)* xeGV{q) 

,veGF(p)* ' 

V xeGF(^)* / 


= p- 1 + 

y" y" lLi{yf{x)) 


yeG¥{p)* xeG¥{q)* 


= p — 1 -t-e 



.veGF(p)* 
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It then follows from Lemma [2] that 


L XiiyD{f)) = 

yeGF{p)* 




e 


if r even 
if r odd. 


Note that uf is also a quadratic form over GF(^) and satisfies all the conditions of Theorem [3] for every 
u G GF(^)*. It then follows from ([5]) that the Hamming weight of the codeword Cu is given by 


wt(c„) 


ep 

(p-i)g 

ep 


if r even 
if r odd, 


where u G GF(^)*. Hence, the dimension of the code is m, as > 0 for each u G GF(^)*. 

If r is odd, the code is a one-weight code with the nonzero weight {p — l)q/ep. If r is even, the code 
has the following nonzero weights 


{p-l)(q+{-iyp'-’i^) 

ep 


for z G {1,2}. Since 0 ^ D{f), the minimum distance of the dual code is at least 2. The first two 
Pless Power Moments lISTl p.260] lead to the following system of equations: 

/ ^W\ T ^W2 ~ P ^5 

\ wiAw^+W2Aw2 = (p-l)p™”^zr/. 

Solving this system of equations gives the desired weight distribution for the case r being even. This 
completes the proof. ■ 

Let D be the set of all nonzero squares in GF(^). It is well known that D is a (^, {q— l)/2, (q — 
3)/2) difference set in (GF(^),-h) if ^ = 3 (mod 4), and an almost difference set with parameters 
(^-l)/2, (^-5)/4, (^-l)/2) if^=l (mod 4). 

As an special case of Theorem |3l we have the following. 


Corollary 4. Let D be the set of all quadratic residues in GF(p'”)*. If m is odd, then Co is a one-weight 
code over GF(p) with parameters [(<?— l)/2, zn, [p— \)q/2p\. 

If m is even, then Co is a two-weight code over GF(p) with parameters [{q— l)/2, zzz, [p — 1)(^ — 
^)/lp\ and weight enumerator 

\ ^ _ (7) 

Proof: Note that f{x) = is a quadratic form of rank m over GF(^) satisfying the conditions of 
Theorem [3l with e = 2. The desired conclusions follow from Theorem [3l ■ 

To obtain more classes of one-weight and two-weight codes from Theorem |3l we need to find quadratic 
forms / over GF(^) satisfying the conditions of Theorem [3l Below are a few more examples. 

i 1 1—1 

Example 1. f{x) —x^^^ is a quadratic form over GF(^) satisfying the conditions of Theorem^ where 
e = gcd{q-l,p^ + 1). 

Example 2. f{x) = x^^ — ux^ — u^x^ is a quadratic form over GF(3™) satisfying the conditions of Theorem 
E] where u G GF(3'”), m is odd, and e = 2. 
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B. The codes Co{f) from the images of some quadratic functions on GF(2™) 

An h-arc in the projective plane PG(2,^), with q a prime power, is a set of /?-points such that no three 
of them are collinear. The maximum value for /z is ^ + 1 if q is odd, and ^ + 2 if ^ is even. If q is odd, 
{q-\- l)-arcs are called ovals. If q is even, (^ + 2)-arcs are called hyperovals. 

In 1998, Maschietti discovered a connection between hyperoval sets and difference sets and proved the 
following result Il38]| . 

Theorem 5. Let m be odd and let n = 2'” — 1. Then 


Dp := {xP +x : X e GF(2™)} \ {0} 

is a difference set with Singer parameters (2™ — 1, 2™“^ — 1, 2™“^ — 1) in (GF(2'”)*, x) if is a 

permutation on GF(2'”) and the mapping Fp :xv^x^ +x is two-to-one on GF(2™). 

In particular, the following p yields difference sets: 

• p = 2 (Singer case). 

• p = 6 (Segre case). 

• p = 2^^ -f 2’'' with a = (m-|- l)/2 and 471 = 1 mod m ( Glynn 1 case). 

• p = 3 ■ 2^^ -f 4 with <3 = (m-\-l)/2 (Glynn II case). 

In the rest of this section, let m be odd. Let p = 2' -|- if where i and j are nonnegative integers such 
that 0 <i < j < m. Let K = j — i. Define 


Im(rp) = {rp(x):xeGF( 2 '")}. 


We now study the code CotTp) when p = 2'-1-2'' and the mapping rp(x) =xP-|-x satisfies certain conditions. 
To this end, we define the following Boolean function from GF(2™) to GF(2): 


= / 1 if ^eim(rp), 


0 otherwise. 


( 8 ) 


The following lemma is proved in |[50l . 


Lemma 6. Let p=2'+2f IfTp is two-to-one on GF(2'”) and gcd(2'^-|-1, 2'" — 1) = 1, where K = j — i, 
then 


0 ifb = 0, 

f{b)={ 0 ifb^Q, Tr(bf = Q, 

± 2 (™+ i )/2 ifbf^O, Trfbf = 1 , 


(9) 


where f denotes the Walsh transform of f and 


i = 


2 '+ 2^-1 
2^+i 


Furthermore, if Tr(Zz^) = 1, 




where b^ = 1 -\-u^^ -|- 


2j+’^ I 


Theorem 7. Let p = 2'-\-2f IfTp is two-to-one on GF(2™) and gcd(2'^-M, 2"* —1) = 1, where K = j — i, 
then the binary code ^^(rp) has parameters [2'”'^ — l,m, 2™“^ — 2^™“^)/^] and the weight distribution of 
Table 0 

Proof: Let n = 2™”^ — 1. Let b G GF(2™)* and Cb be the codeword of dH) in CDpr^y We now determine 
the Hamming weight of c^. 
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TABLE I 

The weight distribution oe the codes oe Theorem[7] 


Weight w 

Multiplicity A„ 

0 

1 

2fft—2 /2 

2m-2 _p2(ni-3)/2 


2"'-‘ - 1 

2J«—2 _|_ 2(^n—3)/2 



By definition, we have 

fiP) 


^ (^_iyf{x)+Mbx) 
xeGF(2™) 

xeim(rp) xeGF(2™)\im(rp) 

-2 ^ (_l)Tr(to) 

xeim(rp) 


-2 I Y. 

, xe£)(rp) 


+ 1 


It then follows from Lemma [6] that 

xi,(£>(rp))€{-i,±2i"-‘>/2-i}. 

The desired eonelusions on the weights and the dimension of this eode Cd{Tp) follow from ([5]). 

It is easily seen that the minimum weight of the dual eode is at least 3. Define 

Wi = 2™-2 W2 = 2"'"^ W3 = 2“-2 

We now determine the number of eodewords with weight Wi in Cd{Tp)- The first three Pless Power 
Moments OTl p.260] lead to the following system of equations: 

r Ayvj + A^2 “h = 2 1, 

< vviAvvi+W2 Avv2 + W3Aw 3 = n2'"~\ (10) 

[ w\Aw^+w\Aw 2 + w1A^^ = n(n+l)2'"“^. 

Solving this system of equations gives the desired weight distribution. This eompletes the proof. 


In the Segre ease, we have p = 2^ +2^, (/, j) = (1,2), and k = 1. Henee ged(2'^+ 1, 2™ — 1) = 1. It is 
known that Fp is two-to-one. Henee, all the eonditions in Theorem |7] are satisfied. Thus, the differenee 
set Dg gives a elass of bianry linear eodes with three weights. 

The following lemma ean be easily proved. 

Lemma 8. Define 

f ifm = ?> (mod4), 

1 ifm=l (mod 4). 

Then god(2'"+1, 2"^ - 1) = 1. 

In the Glynn I ease, (/, j, k) = ((m+ l)/4, (m+ l)/2, (m+ l)/4) if m = 3 (mod 4), and (z, j, k) = 
((m+ l)/2, (3m + l)/4, (m — l)/4) if m = 1 (mod 4). In this ease, we have ged(2'^ + 1, 2™ — 1) = 1 by 
Lemma [8l It is known that, in the Glynn I ease, Fp is two-to-one. Henee, all the eonditions in Theorem 
|7]are satisfied. Thus, the differenee set D 2 i^ 2 J gives a elass of binary linear eodes with three weights. 










In the Glynn II case, p = 3 ■ 2'^ + 4 and the mapping Fp is not quadratic. It looks hard to determine 
the weight distribution of the code Co(Tp)- When m = 5, the binary code fi)(rp) in the Glynn II case 
has parameters [15,5, 6] and the weight enumerator 1 + lOz^ + 15z* + When m = 7, the binary code 
Cd{Tp) in the Glynn II case has parameters [63, 7, 28] and the weight enumerator H-36z^^ + 63z^^ + 28z^^. 
When m > 9, we have the following conjecture. 


in 


Conjecture 1. Let p = 3 ■ 2^'”+^^/^ + 4, where m>9 and m is odd. Then the binary linear code Co[Tp) 
the Glynn 11 case has parameters [2'"“^ — 1, m, 2™“^ _ 2 (™~t)/ 2 j the following five nonzero 

weights: 

'i 2^m—J. ^ 2^(m—I)//. 2 


2 tn ~2 2™~2 2 ('>^~ 1)/2 2 ^ m — 2 ^ 2 ^( m — 3)/2 


Example 3. When m = 9, the binary code Co{Tp) in the Glynn 11 case has parameters [255, 9, 112] and 
weight enumerator H-9z^^^ + 108z^^®+ 285z^^^ + 108z^^^ 

Example 4. When m= 11, the binary code Cd{y ) in the Glynn 11 case has parameters [1023, 11,480] 
and weight enumerator 1 + + 440z^^^ + 1155z^^^ + 408z^^^ + 22z^'^^. 

It would be nice if the weight distribution of the binary linear code Cd{Tp) in the Glynn II case can be 
determined. 


VI. Linear codes from the preimage / ^{b) for functions / from GF(p'”) to GF(p) 

Let / be a function from GF(p'”) to GF(p), and let D be any subset of the preimage f~^{b) for any 
b G GF(p). In this section, we consider the code Co- Similarly, it is very hard to determine the parameters 
of this code in general. We shall deal with a few special cases in this section. 


A. The Boolean case 

Let / be a Boolean function from GF(2™) to GF(2). The support of / is defined to be 


Df = {xe GF(2'”) : f{x) = 1} C GF(2'"). 

Recall that nf = \Df\. 

The Walsh transform of / is defined by 

/("')= E (12) 

;ceGF(2'«) 

where w G GF(2'"). The Walsh spectrum of / is the following multiset 

{{/»:wgGF(2'")}}. 

In this section, we investigate the binary code Cof with length nf and dimension at most m, and 
will determine the weight distribution of the code Cof for several classes of Boolean functions / whose 
supports Df are certain 2-designs. 

A function / from GF(2™) to GF(2) is called linear if f{x + y) = f{x)+f{y) for all (.v,y) G GF(2'”)^. 
A function / from GF(2™) to GF(2) is called affine if / or / — 1 is affine. 

The main result of this section is described in the following theorem. 


Theorem 9. Let symbols and notation be as above. If f is not an affine function, then Cdj is a binary 
linear code with length n f and dimension m, and its weight distribution is given by the following multiset: 


( 2n/ + /(w) 

1 " 


w 


G GF(2^ 



U{{0}}. 


(13) 



Proof: Note that all characters of the group (GF(2'"), +) are of the form 

beGP{r^). 

Let w G GF(2'”)*. It follows from (fT^ that 

/M = - L ^ XwW = -2 XwW = 

xeDf xeGF{2'”)\Df xeDf 

It then follows from ([5]) that the Hamming weight of the codeword of dH) is equal to (2ny^ + /(w))/4. 
Hence, the weight distribution of Cof is given by the multiset in (fTSl) . Since / is not affine, Cw > 0 for 
every nonzero w E GF(2'”). Thus, the dimension of Cuf is equal to nf. This completes the proof. ■ 
Theorem |9] establishes a connection between Boolean functions and a class of linear codes. The 
determination of the weight distribution of the binary linear code Cof is equivalent to that of the Walsh 
spectrum of the Boolean function /. When the Boolean function / is selected properly, the code Cof has 
only a few weights and may have good parameters. We will demonstrate this in the remainder of this 
section. 

1) Linear codes from bent functions: A function from GF(2'”) to GF(2) is called bent if |/(w)| = 2™/^ 
for every w E GF(2'”). Bent functions exist only for even m, and were coined by Rothaus in [|4^ . 

It is well known that a function / from GF(2™) to GF(2) is bent if and only if Dy is a difference set 
in (GF(2™), +) with the following parameters 

(2™, (14) 

Let / be bent. Then by definition /(O) = ±2™/^. It then follows that 

nf = \Df\ = 2™-i (15) 


TABLE II 

The weight distribution of the codes oe CorollaryBoI 


Weight w 

Multiplicity A „ 

0 

1 


9 


2'" —H-«y2 2 ” 

-^- 


As a corollary of Theorem |9l we have the following. 

Corollary 10. Let f be a bent function from GF(2'”) to GF(2) with /(O) = 0, where m > 4 and is even. 
Then Cdj A cm [nf,m, (ny — 2*^'"~^^/^)/2] two-weight binary code with the weight distribution in Table 
13 where nf is defined in l ITTI) . 

Proof: By Theorem [9l the dimension of the code Cof is m as bent functions are not affine. It follows 
from the definition of bent functions and Theorem [9] that Cof has nonzero weights (ny — 2^"*“^i/^)/2 or 

(ny + 2('”-2)/2)/2. 

Let Ai denote the number of codewords with Hamming weight i in Cof It is obvious that the dual code 
has minimum weight at least 2. The first two Pless Power Moments OTl p.260] lead to the following 
system of equations: 

f 1 TA„, m-4 +A„, m-4 = 2'^, 

I 4+2^ 4-2^ 

n £ _ m—4\ 

-J" +2 2 jAnj m-4 4~ 

/ -^+2 2 

The desired weight distribution in Table HI] is obtained by solving (fT^ . 



( 16 ) 
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Example 5. Let m = 6 and let f be a bent function from GF(2^) to GF(2) with \Df \ =2^ ^ — 2^^ = 28. 

Then the code Cof has parameters [28, 6, 12] and is optimal. 

Example 6. Let m = 8 and let f be a bent function from GF(2^) to GF(2) with \Df \ = 2^“^ _ 2 (®“ 2)/2 _ 
120. Then the code Cdj has parameters [120, 8, 56], while the optimal binary code has parameters 
[120, 8,58]. 


There are many eonstruetions of bent funetions and thus Hadamard differenee sets. We refer the reader 
to (Si, [|43l, [|44]| . the book chapter [|9l and the references therein for details. Any bent function can be 
plugged into Corollary [TO] to obtain a two-weight linear code. 

2} Linear codes from semibent functions: Let m be odd. Then there is no bent Boolean function on 
GF(2'”). A function / from GF(2™) to GF(2) is called semibent if /(w) G {0, ±2*^™+^)/^} for every 
wgGF(2'”). 

Let / be a semibent function from GF(2'”) to GF(2). It then follows from the definition of semibent 
functions that 


n/ = \Df\ 


2^m—l _ 2^{m—l)/2 

2^ni— 1 _j_ 2 L /2 

2/n-l 


if /(O) = 2 ('"+i)/ 2, 
if /(o) = _ 2 ('”+i)/ 2 , 
if/(0)=0. 


(17) 


TABLE III 

The weight distribution of the codes oe CorollaryTTI 


Weight w 

Multiplicity A„ 

0 

1 

2 

-'V)2^"'- 

«/ 

J 

2'”-l-«A2"’-«f)2-("’-') 

2 

nA2"'-«f)2^'"+Uf2-("'+l)/2 


A semibent function / gives a 2-design. The reader is referred to ifTTll for details of the 2-design. We 
are interested in the coding theory aspect of semibent functions. 

As a corollary of Theorem |9l we have the following. 


Corollary 11. Let f be a semibent function from GF(2"’) to GF(2) with /(O) =0, where m is odd. Then 
Cof is an [nf,m, — 2('"“^)/^)/2] three-weight binary code with the weight distribution in Table m 
where nf is defined in (|77|). 

Proof: By Theorem |9l the dimension of the code Cdj is m as semibent functions are not affine. It 
follows from the definition of semibent functions and Theorem |9| that Cof has nonzero weights: 


Wl 


n^_2(™-i)/2 

2 


nf 

W2 = y, W3 


2 


We now determine the number of codewords with weight Wi in Cdj - It is straightforward to see that 
the minimum weight of the dual code is at least 3. The first three Pless Power Moments OTl p.260] 
lead to the following system of equations: 


j A^j-fAvyj-|-A vv3 — 2™—1, 

< wiAwj-hW2Avi;2-hW3A„,3 = (18) 

[ WjAwj -h W 2 AW 2 + W3Ah,3 = nf{nf+ 1 )2'”~2. 

Solving this system of equations gives the desired weight distribution. This completes the proof. ■ 

Example 7. Let m = l and let f be a semibent function from GF(22) to GF(2) with \Df \ = 2^”^ _ 2 ( 2 “i )/2 = 
56. Then the code Cdj has parameters [56, 7, 24], while the optimal binary code has parameters [56, 7, 26]. 
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There are a lot of eonstruetions of semibent funetions from GF(2'") to GF(2). We refer the reader to 
Ell, lfT4l . [l24l . dsn, (401, (4^ for detailed eonstruetions. All semibent funetions ean be plugged into 
Corollary [TT] to obtain three-weight binary linear eodes. 

3) Linear codes from almost bent functions: For any funetion g from GF(2'") to GF(2'"), we define 

\{a,b) = ^ (_i)Tr(«g(x)+ta)^ ^ GF(2"’). 

xeGF(2™) 

A function g from GF(2'”) to GF(2"*) is called almost bent if Xg{a,b) = 0, or ±2^"*+^^/^ for every pair 
{a,b) with afO. By definition, almost bent functions over GF(2"*) exist only for odd m. Specific almost 
bent functions are available in (H, [|^. 

By definition, ?ig(l,0) G {0, ±2*^"’+^^/^} for any almost bent function g on GF(2"’). It is straightforward 
to deduce the following lemma. 

Lemma 12. For any almost bent function g from GF(2'”) to GF(2'”), define f = Tr(g). Then we have 

{ 2m-l I 2(«-1)/2 ifX(\ 01 = — 2('”+^)/2 

2m~l_2(m-l)/2 =2("^+1)/2, (19) 

2-1 1/X,(1,0)=0. 

As a corollary of Theorem |9l we have the following. 

Corollary 13. Let g be an almost bent function from GF('2'”) to GF(2'”) with Tr(g(0)) =0, where m is 
odd. Define f = Tr(g). Then Coj Is an [ny, m, (ny — 2('"“i)/^)/2] three-weight binary code with the weight 
distribution in Table where nf is given in t l79l) . 

Proof: By Theorem |9l the dimension of the code Cof is m as f = Tr(g) is not affine. It follows from 
the definition of almost bent functions and Theorem |9] that Cof has nonzero weights: 

ny-2(—1)/2 nf n/ + 2(—1)/2 

2 ’ Y’ 2 ■ 

It is easy to prove that the dual code Cof has minimum weight at least 3. The frequencies of the three 
weights are already determined in the proof of Corollary [TTJ This completes the proof. ■ 

We remark that the binary code Cof of Corollarey [l3] is different from the code from almost bent 
functions defined in ifTOl . as the dimensions and lengths of the codes are different. 

4) Linear codes from quadratic Boolean functions: Let 

/l'n/2\ . \ 

/W=Tr2«72f ^ + 

be a quadratic Boolean function from GF(2'”) to GF(2), where fi E GF(2'”) 
denoted by ry, is defined to be the codimension of the GF(2)-vector space 

Vf = {xE GF(2'") : f{x + z)-nx)-f{z) = 0 V z e GF(2'")}. 

The Walsh spectrum of / is known O and is given in Table UVl 

TABLE IV 

The Walsh spectrum of quadratic Boolean functions 


fW 

the number of w’s 

0 

2™ - 2V 

2m-r//2 

2''/-! -I- 2(''/-2)/2 

_2m-rf/2 

2''/-! — 2(''/-2)/2 


( 20 ) 

. Similarly, the rank of /, 
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Let be the support of /. By definition, we have 



( 2'”~i 

if/(0)=0. 


1 '2rn—\ _ 

if /(O) =2 '"-i-'‘//2. 

(21) 


1 1 _|_ 

if /(O) = -2 '’^-i-''//2. 



The following theorem then follows from Theorem and Table ITVl 

Theorem 14. Let f be a quadratic Boolean function of the form in f[2^ and / 7 ^ 0. Then Cdj Is a binary 
code with length n f given in t l27]) . dimension m, and the weight distribution in Table [0 where 

r (1,0,0) iff{o) = o, 

(£i,£i,£3)= (0,1,0) ^//(0)=2'”-i-'-//2, (22) 

[ ( 0 , 0 , 1 ) ^//( 0 ) = - 2 ™-i-'-// 2 . 

TABLE V 

The weight distribution of the code Cof in TheoremITt] 


Weight w 


0 

1 

"f 

7 . 

2”’-2''/-ei 

-5- 

+2(''/-2)/2 e2 

nf-T'-'-'fl- 

_^_2_ 

2''/-i -2h/-2)/2_e3 


Note that the code Cof in Theorem [T4] defined by any quadratic Boolean function / is different from 
any subcode of the second-order Reed-muller code, due to the difference in their lengths. The weight 
distributions of the two codes are also different. 


B. A ternary case 

In this subsection, we analyse a class of ternary codes whose defining sets are a family of cyclic 
difference sets, which are described in the following theorem ll29l . 

Theorem 15. Let m = 3h> 3 for some positive integer h and i — 3^^^ — 3^^ -t- 1. Define n = (3'” — l)/2 and 

D = : Tr 3 m/ 3 (a^ a!^) = 0, 0<t<n-l|, (23) 


where a is a generator of GF {3”^)*. Then D is a difference set in (GF(3'”)*/GF(2)*, x) with the following 
parameters 


1 3 


m — 1 


3-1’ 3-1 


3,11-2 _ Y \ 

3-1 ;■ 


(24) 


Let f{x) =TYynij,[x + x^), a function from GF(3'”) to GF(3). When h is odd, {D, —D,{0}} forms a 
partition of the preimage f~ ^ ( 0 ). 


TABLE VI 

The weight distribution oe the codes of Theorem[T61 


Weight w 

Multiplicity A„ 

0 

1 


32* + 3'" 


glA 2 X 32/, 1 

33A-2 32A-2 

yih jA 


Our main result of this section is the following. 
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Theorem 16. Let h be an odd positive integer and let m = 3h. Let D be defined as in Then the 
ternary code Co has parameters 

"0 3 / 7—1 1 

^-Zi,3/^,33/^-2_ 32/7-2 

2 

and the weight distribution of Table O 

We remark that the eode Cd of Theorem [16] has more than three nonzero weights if h is even. To prove 
this theorem, we need to introduee the basies of quadratie forms and prove several lemmas first. 

A quadratic form f{X) in m variables over GF(p) is a homogeneous polynomial in G¥{p)[xi,... ,Xm\ 
of degree 2 and can be expressed as 

/(^)= aijXiXj, aijeGF{p), 

\< i < j<m 


where X = {x\,X2t ■ ■ ,Xm). A quadratic form f{X) in m variables over GF(p) may also be expresses in 


the trace form 


/W = Tr 



xeGF(p'”), 


where Tr denotes the trace function from GF(/ 7 '”) to GF(p). 

The rank rf of a quadratic form f{x) over GF(p"’) is defined as the codimension of the GF(p)-vector 
space 

Vf = {xe GF(p-) : f{x + y)-f{x)-f{y) = 0 for all y G GF(p-)}, 


i.e., rf = m — dim(y/-). 

We shall use the following lemma in the sequel lf52]| . 

Lemma 17. Let f{x) be a quadratic form of rank rf over GF(p'”), and let Zp = Then 


Y Y 

,yeGF(p)*xeGF(p™) 


±(p—l)p™ if rf is even, 

0 otherwise. 


Starting from now on, we put p = 3, m = 3h and e = 3*, where h is odd. We consider the following 
quadratic form 

Qu{x) = Tv{ux''^^ +x^) 


over GF(3™). It is easily seen that 

Qu{y + z)-Qu{y)-Qu{z)=Tr{{u''^y‘'^ +uy‘'-y)z). (25) 


By definition, the rank = m — log 3 («!,), where is the number of solutions y G GF(3'”) of the following 
equation 

u^ y^ + My® — y = 0 . (26) 

The following lemma is proved in [|3^ . A direct proof discussing the number of solutions n^ of (l26l) 
can also be given in a straightforward way. 


Lemma 18. The rank rq^^ of the quadratic form Qu is m, or m — h, or m — 2h. 

We will need the following lemma later. 

Lemma 19. The quadratic form Qi{y) over GF(3"’) has rank m = 3h. 

Proof: It suffices to prove that the equation 

y®^+y®-y = 0 
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has the only solution y = 0 in GF(3'"). Raising both sides of this equation to the power of e, we obtain 

y + /-/=0. 

2 

Adding the two equations above yields = 0. Hence, y = 0. This completes the proof. ■ 

We shall employ the following lemma whose proof is straightforward and may be found in [[3^ . 

Lemma 20. The rank of the quadratic form Tr:{bx‘^^^) is m for all b G GF(3™)*. 

The next lemma will play an important role in determining the weight distribution of the code of 
Theorem [T6l 


Lemma 21. For any u G GF(3'”), at least one of the two quadratic forms Quiy) and Q^i-u{y) over 
GF(3'”) has rank m, where m = 3h and h is odd. 

Proof: Suppose on the contrary that both 2„(y) and Q-i-u{y) have rank less than m for some 
u G GF(3™). Then there would exist yi G GF(3'")* and y 2 G GF(3'”)* such that 

f u‘^^y‘^^ +uy\-yi=0, 

[ (1+M)®^yf+ (l+M)y|+y2 =0, 


where e = 3^. 

Note that y® = y for all y G GF(3'”). Raising the first equation of (ITTl) to the power of e®, e^ and e^ 
yields the following system of three equations 


( u‘^"yf Fayl-yi = 0, 


< wyi+M^yf-y^ = 0, 

(28) 

[ uYi+u^^^yi-yf = 0. 


Solving (l28l) gives 


U=yf^-‘^~^ -y\-^-y\-f 

(29) 

Using the second equation of (ITTl) in a similar way, we obtain 


u — —y^ ^ ^ + >'2 ^ 2 ^ “ 1 ■ 

(30) 


We now define 

p{x) 1 G GF(3'”)[x]. 

Combining (l29l) and (l30l) . we arrive at 

P{yi)^-P{y 2 ). 


(31) 


It is straightforward to verify that 


P{x) 




2 

In addition, we have +x® — x 7^ 0 for all x G GF(3'”)*. It follows that P{x) is a nonzero square in 
GF(3'") for every x G GF(3"’)*. Since m is odd, —1 is a nonsquare in GF(3'"). Hence, the equality of (l3TI) 
cannot be possible. This contradiction proves the desired conclusion of this lemma. ■ 

In order to prove Theorem [T6l we have to do more preparations. We now define for each a G GF(3) 
and each b G GF(3"*)*, 


N(b,a) = l{^ e GF(3"^) : Tr(x + x^) = 0 and Tr^bx) = a}\. 
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One can easily prove that 

|DU(-D)| = 3™~i-l. 

It then follows that 

=^{b,2) A^(^,,o) +^(fo,l) +^{b,2) = 3"' 

To determine the weight distribution of the code of Theorem [T^ we need to find out A^(Z 7 ,o) 
b E GF(3'”). Note that £ = — e+l is odd and gcd(3'” — 1,e + 1) =2. We know that is 

the number of solutions x E GF(3'") of the following set of equations 

r Ti.(/+i+y2)=o, 

\ Tr(Z7/+i) = 0. 

We are now ready to prove the following lemma. 


Lemma 22. For each b E GF(3'”)*, has the following three possible values: 


om—l 

^ 5 




Proof: The number of solutions y E GF(3™) of (l3^ is equal to A^(fo,o) ^nd is given by 


Ni 


im 


0 E 


ziTr(/+‘+y2l 


^Z2Tx{by 


,^+13 


yeGF{3^) \ziGGF(3) 


^,Z2eGF(3) 


T 1 

yn-2^ 




1 

9 

1 

9 


yeGF(3'”) 

^ eTr(i/+') 

vveGF(3'«) 


+ E 


3“ H ^3 

yeGF(3™) 


yeGF(3'”) 

Tr(i/+‘) 


,-Tr(/+'+y2) 


+ 


+ 


,Tr((l+Z>)/+'+y2) 


vveGF(3« 


+ E 

yeGF(3" 


,-Tr((l+Z>)/+'+y2'i 


+ 


1 

9 


E £3 

vveGF(3“) 

By Lemmas [T^ and [jTl we have 


Tr((l-i)/+'+y2) -Tr((l-%'^+'+y2) 


+ E ^3 

yeGF(3"') 


1 

9 


gTr(/+‘+y2) 

jeGF(3'”) 


+ E 

yeGF(3™) 


It follows from Lemmas [20] and [TT] that 


1 

9 



Tr(iy 


.e+n 


+ E 

yeGF(3” 


^—Ti{by 


,e+l 


= 0 


0 . 


Combining Lemmas [2T] and HVl we know that at least one of the last two sums of the form ^ ( 
in (l34l) is equal to 0. 

The desired conclusion then follows from (l34l) and Lemma [T3 This completes the proof. 

The following lemma follows from Lemma l22l and (l32l) . 


(32) 

for each 
equal to 

(33) 


(34) 


... + ...) 
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Lemma 23. The triple (A^(fc,o) 5 ^(Z 7 ,i) 5 ^(fc, 2 )) ttikes on only the following three possible values: 

m—2 '^m—2 2 m— 2 ^ 

^^m—2 _j_ 2 ^ _ 32 (/i— 1 ) '^m—2 _ '^2{h—l)^ 

The next lemma follows from Lemma [23] and the definition of . 

Lemma 24. For any b G GF(3'”)*, XiibOf) takes on only one of the three values: 

where Dq = DVJ {—D). 

Finally, we are ready to prove Theorem [T^ 

Proof of Theorem [T6|: 

For X G GF(3"*)*, it follows from ([5]) and Lemma [2^ that the codeword in (Hj) has the following three 

weights: 

vvi := 33^-2 ^ 32/.-2^ _ 33/.-2^ _ 33/.-2 _ 32/.-2_ 

It is easy to prove that the dual code Cq has minimum weight at least 3. We now determine the number 
Aw; of codewords with weight Wi in Co- The first three Pless Power Moments llMl p.260] lead to the 
following system of equations: 

Aw; “t“ Aw 2 “t“ Awg — 

VViAwi + W2 Aw2 + W3Aw3 = 
wf Awi + W2AW2 + W3AW3 = 

Solving this set of three equations proves the weight distribution in Table jVlJ 

Example 8. Let h = \. Then the code Cd of Theorem [75] is a [4,3,2] ternary code with weight enumerator 
1 + 12z^ + 8 z^ + 6z^ according to Magma, which confirms the result of Theorem U6\ 

Example 9. Let h = 3. Then the code Co of Theorem [75| is a [3280,9,2106] ternary code with weight 
enumerator 1 + + 18224z^^^^ + 702z^^^® according to Magma, which confirms the result of 

Theorem [76] 


33 /^-!, 

33/^'1(33/^-1-1), (35) 

36/1-3^3/7-1 


VII. Concluding remarks 

Although the idea of constructing linear codes in this paper is simple, one-weight codes, two-weight 
codes, and three-weight codes are constructed with those 2-designs. The codes are interesting, as one- 
weight codes, two-weight codes and three-weight codes have applications in secret sharing [[Tl and 
authentication codes []2T]| . There is a survey on two-weight codes 0. Some interesting two-weight and 
three-weight codes were presented in 0, [[T5]| . ||T3]| . []25][, |[33 . |]3^ . |]49l . and |[53 . 

There are many other types of difference sets in (GF(p'”),-f) and (GF(p'")*, x) [[T^ . which give 
automatically linear codes within the framework of the construction of this paper. But it may be difficult 
to determine the parameters of these codes. The reader is cordially invited to attack this problem. 

Cyclic difference sets were employed to construct constant-weight codes in [[34]| . A cyclic code approach 
to bent functions over GF(2) and Z 4 is given in |]48]l . Almost perfect nonlinear functions and almost bent 
functions are employed to construct linear codes in [[T0]| . Kerdock codes are also related to bent functions 
|]9l . Some three-weight binary codes are also presented in [[33 [Theorems 33 and 34]. A related construction 
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of linear codes is presented in iHTlI . In some of these references, a linear code over GF(^) is constructed 
with a highly nonlinear function / from GF(^) to GF(^) and is defined by 

C{f) = {c = {Tr{af{x) + bx)^^Q^q)* : a G GF(^), Z? G GF(^)}. 

Its length is q—l, and its dimension is usually 2m. The dual of C{f) has usually dimension q—l — 2m. 
This approach gives a coding-theory characterisation of APN monomials, almost bent functions, and 
semibent functions (see, for examples, ifTOll . iTTl and (SOl). Theorem |9] of this papers gives automatically 
another coding-theory characterisation of APN monomials, almost bent functions, and semibent functions, 
though it looks simple and easy to derive. 

The construction of linear codes with 2-designs in this paper is different from all these constructions 
due to the difference in the dimension of the codes. The codes dealt with in this paper have dimension 
usually m, and length n, which is smaller than q—l and may not divide q—l. 

It is obvious that the construction of linear codes of this paper is different from the classical one 
employing the incidence matrix of a design due to the difference in the length of the codes. 

Any linear code over GF(p) can be employed to construct secret sharing schemes |[I1, [ITT]| . llSTIl . In 
order to obtain secret sharing schemes with interesting access structures, we would like to have linear 
codes C such that Wmin/w^max > [ISn . where Wmin and Wmax denote the minimum and maximum 
nonzero weight of the linear code. 

The one-weight code of Theorem |4] can be employed to construct secret sharing schemes using the 
approach of [[U. For the two-weight and three-weight codes over GF(p) obtained in this paper, we have 
provided that m is large enough. Therefore, almost all the codes of this paper can be employed 
to construct secret sharing schemes with certain interesting access structures [ISTll . 
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